CVE-2019-25376CWE-79

OPNsense 19.1 Reflected XSS via proxy endpoint

Medium · published February 15, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
35.2
In the wild
Unconfirmed
What it is

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL parameter. Attackers can send POST requests to the proxy endpoint with JavaScript code in the ignoreLogACL parameter to execute arbitrary scripts in users' browsers.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00420 · 35.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-15T13:58Z
EPSS history
Timeline
  • 15 FEB 13:58Z
    OPNsense 19.1 Reflected XSS via proxy endpoint
    cvelistv5